Is there a public PoC exploit available for CVE-2026-59943?

Yes, a public proof-of-concept exploit is available for CVE-2026-59943. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-59943?

Yes, a patch is available for CVE-2026-59943. Update the affected software to the latest version immediately.

Dompdf CVE-2026-59943

Q: What is the CVSS score of CVE-2026-59943?

CVE-2026-59943 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-50027 MEDIUM

Error Message Information Leak (CWE-209)

2026-07-22 https://github.com/dompdf/dompdf

GHSA-j8qw-6jw8-r297

PHP Information Disclosure

6.3

CVSS 4.0 · Vendor: https://github.com/dompdf/dompdf

Severity by source

Vendor (https://github.com/dompdf/dompdf) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network vector as rendering is exposed via web endpoints; PR:L because submitting content for rendering typically requires application-level access; C:L for filesystem existence oracle only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/dompdf/dompdf).

CVSS VectorVendor: https://github.com/dompdf/dompdf

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 28, 2026 - 21:22 NVD

6.3 (MEDIUM)

Source Code Evidence Fetched

Jul 22, 2026 - 23:16 vuln.today

Analysis Generated

Jul 22, 2026 - 23:16 vuln.today

DescriptionCVE.org

Summary

If a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI encoded SVG document.

Details

Using an <image> element inside a data-URI embedded SVG, an attacker can attempt to embed other files via the href or xlink:href attributes. When processing a file that does not exist (e.g. file:///DOESNOTEXIST), dompdf behaves differently than it does when accessing a file or directory that actually exists on the filesystem.

[Wed May 20 19:49:53 2026] PHP Warning:  file_get_contents(file:///DOESNOTEXIST): Failed to open stream: No such file or directory in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 173
[Wed May 20 19:49:53 2026] PHP Notice:  getimagesize(): Error reading from /tmp/svgsk9247ela7tm3SiqGyP! in vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php on line 196

PoC

First, the attacker renders this HTML document:

<html>
<head>
</head>
<body>
<img src="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEwMCAxMDAiCiAgICAgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KICAgIDxpbWFnZSB4bGluazpocmVmPSJmaWxlOi8vL2V0Yy9wYXNzd2QiIHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAiIGhlaWdodD0iMTAwIj4KICAgIDwvc3ZnPgo=">
 Hello World!
</body>
</html>

The <img> tag contains the following SVG content:

xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="100%" height="100%" viewBox="0 0 100 100"
     xmlns="http://www.w3.org/2000/svg">
    <image xlink:href="file:///etc/passwd" x="0" y="0" width="100" height="100">
    </svg>

As expected, the resulting PDF contains a broken image: <img width="621" height="193" alt="image" src="https://github.com/user-attachments/assets/b615fabe-c578-4435-bcb4-e9ad0ac796d2" />

However, when supplying a path to a file or directory that does not exist, for example:

xml

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<svg width="100%" height="100%" viewBox="0 0 100 100"
     xmlns="http://www.w3.org/2000/svg">
    <image xlink:href="file:///DOESNOTEXIST" x="0" y="0" width="100" height="100">
    </svg>

The resulting PDF is rendered normally, with the image displayed as empty space (since the file did not exist). Additionally, for easier visual inspection, a rendering bug (https://github.com/dompdf/php-svg-lib/issues/142) is used to rotate the "Hello World!" text 180 degrees from the expected position:

Impact

By exploiting this vulnerability, an attacker is able to confirm the existence of files and directories located on the backend filesystem.

AnalysisAI

Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an <image> element with a file:// URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.

Technical ContextAI

Dompdf is a PHP library (composer package dompdf/dompdf) that converts HTML to PDF using a rendering pipeline that includes SVG support via php-svg-lib. The vulnerable code path runs through vendor/dompdf/php-svg-lib/src/Svg/Surface/SurfaceCpdf.php, which processes SVG <image> elements and attempts to load referenced resources - including file:// URIs pointing to local filesystem paths - via file_get_contents() and getimagesize(). When an image reference resolves to an existing file, the renderer behaves differently (broken image placeholder) than when the file does not exist (empty space with normal layout), creating an observable side-channel. The root cause is CWE-209: the application exposes filesystem access feedback through differing rendering outputs. The fix in src/Helpers.php adds a guard for the data:// protocol (if (empty($protocol) || $protocol === 'data://')) to prevent data-URI embedded SVGs from having their internal image references resolved as filesystem paths.

RemediationAI

Upgrade to dompdf/dompdf version 3.1.6 or later using Composer: composer update dompdf/dompdf. The patch is confirmed in commit 6a58996865db05d8fede748507e50ac4b8c5bfd0 (https://github.com/dompdf/dompdf/commit/6a58996865db05d8fede748507e50ac4b8c5bfd0) and released in the tagged version at https://github.com/dompdf/dompdf/releases/tag/v3.1.6. If upgrading is not immediately possible, the most effective compensating control is to sanitize or reject HTML/SVG input before passing it to Dompdf - specifically stripping or blocking file:// URI schemes and data:image/svg+xml data URIs containing <image> elements with external href or xlink:href attributes. Alternatively, restricting filesystem permissions for the PHP process so it cannot read sensitive paths (e.g., /etc/passwd, application configuration files) limits the reconnaissance value of the oracle, though it does not eliminate the side-channel.